SOBR to Wasabi

[Thomas N.]

Hello all,
I testing SOBR to Wasabi and so far it has been working well. For those that using Wasabi, when you create the bucket, are you putting the bucket into Wasabi Lock mode or Wasabi Compliance mode? Following the documentation, I enabled object locking so the bucket is in Wasabi Lock mode when i created the bucket. But when in Wasabi Lock mode, in the Wasabi portal I don't see the option to disallow anyone from deleting objects from the bucket. I think that can only be achieved in Wasabi Compliance mode. Can anyone recommend best practice for the bucket settings? Thanks.

[Mildur]

You don't have to configure anything besides Object Lock.
https://wasabi-support.zendesk.com/hc/e ... 0059655831

Veeam will automatically offload each object in the Compliance object lock mode.

[Thomas N.]

I have done that but i can still log into the Wasabi portal and delete the objects that are still within the Immutable retention period. I would like to know how to prevent that if I enabled Object Locking on the bucket.

[Mildur]

That should not be possible, if you have configured the immutability setting in the capacity wizard.
If you have configured immutabily there, and the objects can be deleted, a support case is needed to find out what is happening here.

[Gostev]

From what I remember, with Amazon S3 web client immutable objects deletion is also allowed. But it's not a true deletion, as the whole S3 Object Lock feature is based on versioning. So when you delete an object, its immutable object version remains and can be used by Veeam for restore. And it's merely a web client design not to display previous versions of deleted objects. I wonder if Wasabi web client works exactly the same? Their support would know.

[Thomas N.]

That should not be possible, if you have configured the immutability setting in the capacity wizard.
If you have configured immutabily there, and the objects can be deleted, a support case is needed to find out what is happening here.

Mildur,
You are correct from the Veeam side but I want to apply that security on the Wasabi end also. I don't have the option "Enable Compliance mode" in the Wasabi bucket with Object locking enabled. That option is only available in Wasabi Compliance mode.

[Mildur]

Mildur,
You are correct from the Veeam side but I want to apply that security on the Wasabi end also. I don't have the option "Enable Compliance mode" in the Wasabi bucket with Object locking enabled. That option is only available in Wasabi Compliance mode.

I don't think, that this is supported by veeam, configuring such settings on the object storage itself.
I think, this may lead to unexpected behaviour.

For an example, configuring the retention policy is definitely not allowed:

Considerations and Limitations for Immutability
After you have created an S3 bucket with Object Lock enabled, check that the default retention is disabled. For this edit Object Lock retention settings as described in AWS documentation.

The default retention may result in an unpredictable system behavior and data loss. However, note that Veeam Backup & Replication will use Compliance object lock mode for each uploaded object. For more information on the retention modes, see AWS documentation.

https://helpcenter.veeam.com/docs/backu ... ml?ver=110

[Thomas N.]

Mildur,
I tested a bucket in Wasabi Compliance Mode and the SOBR didn't like it. Thanks for the help.

[Mildur]

Your welcome.
Thanks for letting us know the outcome of your tests.